I didn't find any way to update security identity username in Acl, I think it should be very useful to include in MutableAclProvider a method to do this.
Consider these scenarios:

• a user changes his unsername and loses all his ACEs;
• a user changes his username and loses all his ACEs, while another user signs up with the first user's username and gains all the first user ACEs!

Another method for removing all ACEs from a SecurityIdentity would be useful too.